KR20180102884A - Firewall and processing method for packet thereof - Google Patents

Abstract

According to an embodiment of the present invention, a packet processing method of a firewall comprises the steps of: primarily determining whether a packet is blocked by a content blocking condition including all content IDs and a first security policy including five tuple information of a primary blocking target when the packet is received; extracting content included in the packet only for a packet permitted for transmission by the first security policy; and secondarily determining whether the packet is blocked by matching the content and a content ID of a secondary blocking target included in a second security policy. Therefore, the method can rapidly inspect validity of the packet by using the five tuple information and deep packet inspection (DPI) information.

Description

FIELD AND PROCESSING METHOD FOR PACKET THEREOF FIELD OF THE INVENTION [0001]

An embodiment of the present invention relates to a firewall and a method for processing the packet.

In general, information security between a network and the Internet is provided by a firewall that allows and blocks traffic in the direction of the sender or receiver. Unauthorized access using a network is occurring through various harmful IPs and ports in various countries. In addition, a good internal user may be a subject of a malicious attack such as a zombie PC, a botnet, etc. by various attack methods such as email, phishing, and pharming. In such an environment, an attack from the outside, a malicious The action (connection to the harmful IP) needs to be confirmed.

Conventional firewall devices include a firewall device for processing incoming packets based on five tuple information consisting of a source IP address, a destination IP address, a protocol, a destination protocol port, and a destination protocol port; Expensive firewall devices that process packets based on the contents of PDUs (Protocol Data Unit) using DPI (Deep Packet Inspection) technology in addition to tuple information.

A firewall device based solely on 5 tuple information processes an incoming packet with a basic policy and / or one or more blending policies for each item including 5 tuple information, and the firewall administrator sets policies by using 5 tuple information in advance And reflects it to the firewall device.

On the other hand, in the case of a firewall device using expensive DPI technology, a high-speed packet processor that can quickly process a packet is generally used because the contents of the packet must be checked.

SUMMARY OF THE INVENTION It is a technical object of the present invention to provide a firewall and its packet processing method capable of rapidly checking the validity of a packet using 5-tuple information and DPI information.

A packet processing method of a firewall according to an exemplary embodiment of the present invention is a method of processing a packet according to a first security policy including a content blocking condition including all content IDs and five tuple information of a first blocking target The method comprising the steps of: firstly determining whether the packet is blocked; extracting contents included in the packet only for a packet permitted to be transmitted according to the first security policy; And secondarily determining whether to block the packet by matching the content ID of the secondary blocking object.

According to an embodiment, the step of primarily determining whether to block the packet may be performed when the packet is authenticated as valid through session management.

According to an embodiment, the first security policy includes the content blocking condition including a source IP address, a source port, a destination IP address, a destination port, mode information, and all the content IDs for the primary blocking object .

According to an embodiment of the present invention, the step of primarily determining whether to block the packet may include: determining whether the identification information included in the packet is included in the source IP address, the source port, the destination IP Address, the destination port, and the mode information, the packet may be blocked.

According to an embodiment, the second security policy may include the content ID of the secondary blocking object, the source IP address, source port, destination IP address, destination port, and mode information for the secondary blocking object have.

According to an embodiment, the step of secondarily determining whether to block the packet may allow the packet if the content and the content ID do not match.

According to an embodiment of the present invention, the step of secondarily determining whether to block the packet may block the packet including the content when the content matches the content ID.

According to an embodiment of the present invention, the step of secondarily determining whether to block the packet may include: determining whether the content and the content ID are matched with each other based on the identification information included in the packet and the source IP address, Address, the destination port, and the mode information, and when the identification information matches the source IP address, the source port, the destination IP address, the destination port, and the mode information, have.

The firewall according to another embodiment of the present invention may include a first security policy including content blocking conditions including all content IDs and five tuple information of a first blocking target, A security policy checking unit for determining whether a packet is blocked according to a security policy; and a content detecting unit for extracting content included in the packet, wherein the security policy checking unit checks whether the packet is blocked according to the first security policy And determines whether to block the packet according to the second security policy only for the packet that is permitted to be transmitted.

Further comprising a session management unit for determining the validity of the packet and providing only the packet authenticated as valid to the security policy checking unit according to the embodiment.

According to an embodiment, the first security policy includes the content blocking condition including a source IP address, a source port, a destination IP address, a destination port, mode information, and all the content IDs for the primary blocking object .

According to an embodiment, the security policy checking unit may match the identification information included in the packet with the first security policy, and may block the packet if the identification information matches the first security policy.

According to an embodiment, the second security policy may further include a source IP address, a source port, a destination IP address, a destination port, and mode information for the secondary blocking object.

According to an embodiment, the security policy checking unit may match the content with the content ID, and may block the packet including the content when the content matches the content ID.

According to an embodiment of the present invention, the security policy checking unit may match the content with the content ID, and when the content matches the content ID, the security policy checking unit may compare the identification information included in the packet and the source IP address, The destination IP address, the destination port, and the mode information, and when the identification information matches the source IP address, the source port, the destination IP address, the destination port, and the mode information, Can be blocked.

According to the firewall and the packet processing method according to the embodiment of the present invention, content matching is selectively performed only on packets determined to be valid, so that it is possible to quickly determine whether or not the packet is a malicious packet, Can be inspected.

1 is a conceptual diagram for explaining a packet processing method of a firewall according to an embodiment of the present invention.
2 is a schematic block diagram of a firewall according to an embodiment of the present invention.
3 is a flowchart illustrating a method of processing a packet of a firewall according to an embodiment of the present invention.
4 is a flowchart illustrating a packet processing method of a firewall according to another embodiment of the present invention.

It is to be understood that the specific structural or functional description of embodiments of the present invention disclosed herein is for illustrative purposes only and is not intended to limit the scope of the inventive concept But may be embodied in many different forms and is not limited to the embodiments set forth herein.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It should be understood, however, that it is not intended to limit the embodiments according to the concepts of the present invention to the particular forms disclosed, but includes all modifications, equivalents, or alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example, without departing from the scope of the right according to the concept of the present invention, the first element may be referred to as a second element, The component may also be referred to as a first component.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like are used to specify that there are features, numbers, steps, operations, elements, parts or combinations thereof described herein, But do not preclude the presence or addition of one or more other features, integers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

As used herein, a firewall may refer to a functional or structural combination of hardware to perform a method according to an embodiment of the present invention or software that can drive the hardware. Accordingly, the module may refer to a logical unit or a set of hardware resources capable of executing the program code and the program code, and does not necessarily mean a physically connected code or a kind of hardware.

FIG. 1 is a conceptual diagram for explaining a packet processing method of a firewall according to an embodiment of the present invention, and FIG. 2 is a schematic block diagram of a firewall according to an embodiment of the present invention.

Referring to FIG. 1, a client 200 is connected to a firewall 100 and can perform an operation in response to a packet received from the server 300 through the firewall 100.

For example, the client 200 may be a PC, a smart phone, a tablet PC, a mobile internet device (MID), an internet tablet, an Internet of things (IoE) ) Device, a desktop computer, a laptop computer, a workstation computer, or a personal digital assistant (PDA).

The server 300 is connected to the firewall 100 through the network 400 and can send and receive packets with the client 200 through the firewall 100.

For example, the server 300 may include a domain name system (DNS) server, a network time protocol (NTP) server, a simple service discovery protocol (SSDP) server, a peer to peer (P2P) server, but is not limited to, a web server.

The network 400 may refer to a wired Internet network, a wireless Internet network, or a WiFi network.

The firewall 100 is connected to the server 300 through the network 400 and may be connected to the plurality of clients 200. [

The firewall 100 can manage packets transmitted and received between the server 300 and the clients 200. [ The packet may be a downlink packet transmitted from the server 300 to the firewall 100 through the network 400 or an uplink packet transmitted from each of the clients 200 to the firewall 100.

The packet transmitted from the client 200 to the firewall 100 is an uplink packet and the packet transmitted from the server 300 to the firewall 100 through the network 400 may be a downlink packet.

The firewall 100 may forward or block the packet received through the network 400 to the client 200 based on a predetermined security policy.

In particular, the firewall 100 may primarily determine whether to block the packet using the first security policy.

Here, the first security policy may include five pieces of tuple information of a primary blocking object and a content blocking condition. Here, the content blocking condition of the first security policy does not include a specific content ID and includes all the content IDs.

Therefore, since the content blocking condition of the first security policy includes all the content IDs, the firewall 100 does not need to check the content included in the packet and matches the 5-tuple information about the primary blocking object with the packet identification information I can decide whether or not

For example, the firewall 100 may include a source IP address, a source port, a destination IP address, a destination port, and mode information for a primary blocking object, a source IP address, a source port, a destination IP address, a destination port, The information can be matched to determine whether to block.

If the identification information included in the packet matches both the source IP address, the source port, the destination IP address, the destination port, and the mode information for the primary blocking object, the firewall 100 sets the packet as a blocking object packet It can be judged. The firewall 100 may block the packet to be blocked from being transmitted to the client 200. [

On the other hand, if the identification information included in the packet does not match at least one of the source IP address, the source port, the destination IP address, the destination port, and the mode information for the primary blocking object, .

If the identification information of the packet does not match the 5-tuple information in the first security policy, the firewall 100 can extract the content included in the packet.

That is, the firewall 100 may determine whether to block the packet according to the first security policy, and then secondarily determine whether the packet is blocked according to the second security policy, only for the packet permitted to be transmitted.

Here, the second security policy may include five tuple information and a content ID of a secondary blocking object.

According to the embodiment, the firewall 100 can determine whether to block the packet by matching the content extracted from the packet with the content ID of the secondary blocking object.

If the content extracted from the packet and the content ID of the secondary blocking object do not match, the firewall 100 can determine that the packet is valid and can transmit the secondarily authenticated packet to the client 200 .

On the other hand, if the content extracted from the packet and the content ID of the secondary blocking object are matched, the firewall 100 can determine that the packet is to be blocked. The firewall 100 may block the packet to be blocked from being transmitted to the client 200. [

According to another embodiment, the firewall 100 may determine whether to block the packet using the identification information and the content of the packet, the 5 tuple information and the content ID of the second security policy.

If the content extracted from the packet and the content ID of the secondary blocking object do not match, the firewall 100 can determine that the packet is valid and can transmit the secondarily authenticated packet to the client 200 .

If the content extracted from the packet and the content ID of the secondary blocking object are matched, the firewall 100 may further match the 5-tuple information set for the blocking object with the identification information included in the packet.

At this time, if the identification information of the packet does not match at least one of the source IP address, the source port, the destination IP address, the destination port, and the mode information set for the secondary blocking object, the firewall 100 determines that the packet is valid And can transmit the second authenticated packet to the client 200.

On the other hand, if the identification information of the packet matches the source IP address, the source port, the destination IP address, the destination port, and the mode information set for the secondary blocking object, the firewall 100 blocks It can be determined as a target packet. The firewall can block the packet to be blocked from being transmitted to the client 200. [

Meanwhile, since the conventional 5-tile-based firewall has established a security policy using only 5 tuple information, when there are many servers to be managed, one or more security policies have to be established for each server. Therefore, the conventional firewall has high complexity, low visibility, and difficulty in distinguishing the forgery and corruption of the packet.

In addition, since the firewall using the conventional DPI technology recognizes the contents of all packets and processes the security policy according to the contents, there is a problem that the delay is serious when the security policy is processed.

However, the firewall 100 according to the exemplary embodiment of the present invention inspects a block object primarily irrespective of contents using a first security policy including content blocking conditions and five tuple information including all content IDs, Step checking method for performing content matching only for packets determined to be valid according to the first security policy.

That is, the firewall 100 according to the embodiment of the present invention selectively performs content matching only on packets that are determined to be valid, thereby making it possible to perform a secondary checking can do.

Therefore, the firewall 100 according to the embodiment of the present invention can determine whether to block the packet at a faster rate than the conventional firewall device.

In FIG. 1, the firewall 100 is shown as a separate device outside the client 200, but the firewall 100 is not limited thereto. The firewall 100 may be operated as separate software in the client 200.

Referring to FIG. 2, a firewall 100 including a session management unit 110, a security policy checking unit 120, and a content recognition unit 130 is illustrated.

The session management unit 110 may receive the packet PK through the network and determine the validity of the packet PK by session management.

For example, the session management unit 110 can determine the validity of the packet PK by using an http session or using a cookie. However, the function of the session management unit 110 is not limited thereto and can be variously modified.

The security policy checking unit 120 can primarily determine whether to block the content (CI) included in the packet PK according to the first security policy, It is possible to secondarily determine whether or not to block based on the content (CI).

Since the content blocking condition of the first security policy includes all the content IDs, the security policy checking unit 120 may match the 5-tuple information on the primary blocking object with the identification information of the packet irrespective of the content included in the packet , The packet PK may be blocked or authenticated primarily as valid according to the matching result.

The content recognition unit 130 can extract the content CI from the PK that is primarily authenticated by the security policy checking unit 120 and can extract the content CI extracted from the PK, (120).

According to an embodiment, the content recognition unit 130 can extract the content (CI) included in the packet PK through signature pattern matching.

For example, the content recognition unit 130 may extract a web page included in the packet PK and extract the URL by parsing the extracted web page. The content recognition unit 130 can identify the source of the packet PK by performing signature pattern matching between the extracted URL and a URL stored in advance. However, the method of identifying the content (CI) included in the packet PK by the content recognition unit 130 is not limited thereto and can be variously modified.

The security policy checking unit 120 may match the content ID included in the packet PK with the content ID included in the second security policy and may block the packet PK according to the matching result, You can authenticate.

The security policy checking unit 120 can provide only the secondarily authenticated packet PK to the client 200. [

3 is a flowchart illustrating a method of processing a packet of a firewall according to an embodiment of the present invention.

Referring to FIG. 3, when a packet PK is received from the network 400, the firewall 100 can determine the validity of the packet PK by session management, and only the packet PK whose validity is authenticated is received , And blocks an invalid packet (PK) (S100).

The firewall 100 may match the identification information of the packet PK with the 5 tuple information of the primary blocking object included in the first security policy at step S110.

If the identification information of the packet PK matches the 5 tuple information of the primary blocking object, the firewall 100 judges the packet PK as the blocking object packet, and the packet PK is sent to the client 200 (S150).

On the other hand, if the identification information of the packet PK does not match the 5 tuple information of the primary blocking object, the firewall 100 judges that the packet PK is valid and extracts the content CI from the packet PK (S120).

The firewall 100 may match the content (CI) of the packet (PK) with the content ID included in the second security policy (S130).

If the content CI of the packet PK matches the content ID included in the second security policy, the firewall 100 determines that the packet PK is a blocking object packet, 200) (S150).

On the other hand, if the content CI of the packet PK does not match the content ID included in the second security policy, the firewall 100 determines that the packet PK is valid and transmits the packet PK to the client 200 (S140).

4 is a flowchart illustrating a packet processing method of a firewall according to another embodiment of the present invention.

Referring to FIG. 4, when a packet PK is received from the network 400, the firewall 100 can determine the validity of the packet PK by session management, and only the packet PK whose validity is authenticated is received , And blocks an invalid packet (PK) (S100).

The firewall 100 may match the identification information of the packet PK with the 5 tuple information of the primary blocking object included in the first security policy at step S110.

If the identification information of the packet PK matches the 5 tuple information of the primary blocking object, the firewall 100 judges the packet PK as the blocking object packet, and the packet PK is sent to the client 200 (S150).

On the other hand, if the identification information of the packet PK does not match the 5 tuple information of the primary blocking object, the firewall 100 judges that the packet PK is valid and extracts the content CI from the packet PK (S120).

The firewall 100 may match the content CI of the packet PK with the content blocking condition included in the second security policy at step S130.

If the content (CI) of the packet PK matches the content ID included in the second security policy, the firewall further identifies the identification information of the packet (PK) And can match each other with the tuple information (S130-1).

When the identification information of the packet PK and the 5 tuple information included in the second security policy match each other, the firewall 100 judges that the packet PK is a blocking object packet, (S150).

On the other hand, if the identification information of the packet PK and the 5 tuple information included in the second security policy do not match each other, the firewall 100 judges that the packet PK is valid and transmits the packet PK to the client 200 (S140).

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: Firewall
110:
120: Security policy checker
130:
200: Client
300: server
400: Network

Claims (15)

Determining whether the packet is blocked according to a first security policy including a content blocking condition including all content IDs and five tuple information of a first blocking target when the packet is received;
Extracting a content included in the packet only for a packet permitted to be transmitted according to the first security policy; And
And secondarily determining whether to block the content by matching a content ID of a secondary blocking object included in the second security policy with the content. 2. The method of claim 1, wherein the step of primarily determining whether to block the packet comprises:
And if the packet is authenticated as being valid through session management. The method according to claim 1,
Wherein the first security policy includes a content blocking condition including a content blocking condition including a source IP address, a source port, a destination IP address, a destination port, mode information, and all the content IDs for the primary blocking object . 4. The method of claim 3, wherein the step of primarily determining whether to block the packet comprises:
When the identification information included in the packet is matched with the source IP address, the source port, the destination IP address, the destination port, and the mode information regardless of the content included in the packet, A method of processing a packet in a firewall. The method according to claim 1,
Wherein the second security policy includes the content ID of the secondary blocking object and a source IP address, a source port, a destination IP address, a destination port, and mode information for the secondary blocking object. 6. The method of claim 5, wherein the step of secondarily determining whether to block the packet comprises:
And allowing the packet if the content and the content ID do not match. 6. The method of claim 5, wherein the step of secondarily determining whether to block the packet comprises:
And if the content matches the content ID, blocks the packet including the content. 6. The method of claim 5, wherein the step of secondarily determining whether to block the packet comprises:
The source IP address, the destination IP address, the destination port, and the mode information included in the packet if the content matches the content ID,
And blocking the packet if the identification information matches the source IP address, the source port, the destination IP address, the destination port, and the mode information. Determines whether to block the packet according to a first security policy including a content blocking condition including all content IDs and five tuple information of a primary blocking target and a second security policy including a content ID of a secondary blocking target A security policy checking unit; And
And a contents recognition unit for extracting contents included in the packet,
Wherein the security policy checking unit determines whether to block the packet according to the first security policy, and then determines whether to block the packet according to the second security policy only for a packet permitted to be transmitted. 10. The method of claim 9,
And a session management unit for determining the validity of the packet and providing only the packet authenticated as valid to the security policy checking unit. 10. The method of claim 9,
Wherein the first security policy includes the content blocking condition including a source IP address, a source port, a destination IP address, a destination port, mode information, and all the content IDs for the primary blocking object. 12. The security policy checking system according to claim 11,
The identification information included in the packet is matched with the first security policy,
And for blocking the packet if the identification information matches the first security policy. 10. The method of claim 9,
Wherein the second security policy further comprises a source IP address, a source port, a destination IP address, a destination port, and mode information for the secondary blocking object. 14. The security policy checking system according to claim 13,
The content and the content ID are matched,
And blocks the packet including the content when the content matches the content ID. 14. The security policy checking system according to claim 13,
The content and the content ID are matched,
The source IP address, the destination IP address, the destination port, and the mode information included in the packet if the content matches the content ID,
And blocks the packet if the identification information matches the source IP address, the source port, the destination IP address, the destination port, and the mode information.

Images